Application Error Disclosure hunting... (Passive 90022)

[Ian]

I got this alert for one of our 500 error pages.  The plugin doesn't tell you which pattern was used to match, or the string it matched with which means I've got to figure this out myself.

I ran a string of commands to extract the string patterns from the patterns file:

grep -Po "\Q<Pattern type=\"string\">\E\K.*" application_errors.xml|cut -d '<' -f 1 > strings.txt

and another for the regex:

grep -Po "\Q<Pattern type=\"regex\">\E\K.*" application_errors.xml|cut -d '<' -f 1 > regex.txt

I saved the raw response to file by right clicking on the alert, save raw, response, all

I then ran two commands to search for the patterns:

grep -i -F -f ./string.txt ~/raw.html.raw

and

grep -i -f ./regex.txt ~/raw.html.raw

grep -E -i -f ./regex.txt ~/raw.html.raw

but nothing matched.  I've got to be close -- do I need to alter the regex patterns to be compatible with grep somehow?  Is there an easier way to find out how this plugin found what it did?

[kingthorin+owaspzap]

Look at the Evidence field of the alert, or the part of the response that is highlighted when you are viewing the alert.

[hauschu...@gmail.com]

I could be wrong, but I seem to remember reading that basically any HTTP 500 error will alert as Application Error Disclosure, since properly setup ideal servers should handle improper input with something in the 400 range (bad request, unauthorized, denied, not found, etc) whereas 500 is a catch-all that indicates (generally) that the server is still in some kind of default configuration...

[Ian]

Ugh ... how did I miss that!

One thing about the highlights though -- I usually see stuff highlighted in the Response tab -- I had though it was only doing that for script and CSS code, but I now see that "HTTP/1.1 500 Server Error" is highlighted in gray.

[Ian]

I thought application error disclosures were meant to disclose underlying software based on the error message?  Netsparker doesn't generate this alert.

[Ian]

Any chance we could have Zap give a different alert on generic 500 results? I double checked and Netsparker has a separate  "Internal Server Error" Low level alert.  (A third party recently scanned us so I get to see how Zap compares!  :) )

There were some other findings that Zap didn't see, but I'll post those separately (if you want).

[Simon Bennetts]

I'm all for making it clear that these are for 500s, and maybe having an option for supressing them - could you raise a new issue for this?

And also very happy to hear of findings from other tools that ZAP does not report - you can raise these as new issues as well :)

Many thanks

Simon